# Ecommerce DDoS and Availability Protection

> Prepare layered capacity and traffic controls for denial-of-service attacks while preserving legitimate sales-event traffic.

- Type: Merchant guide
- Level: Intermediate
- Reading time: About 4 minutes
- Audience: Written for store owners, builders, and designers refining high-performance ecommerce stores.
- Last updated: 2026-11-04
- Canonical page: https://academy.getzenbasket.com/merchant-questions/ecommerce-ddos-and-availability-protection/
- Part of: [Merchant Questions](https://academy.getzenbasket.com/merchant-questions/) on ZenBasket Academy

---

## What you need to know

### What is a DDoS attack?

A distributed denial-of-service attack uses traffic from many sources to exhaust network or application capacity and make a service unavailable.

### Can ecommerce stores be targeted by DDoS attacks?

Yes. Stores may be attacked for extortion, disruption, competition, or distraction, especially during launches and major sales.

### How should ecommerce platforms prepare for traffic-based attacks?

Use layered network and application protection, origin shielding, capacity planning, caching, rate controls, provider coordination, monitoring and a tested incident plan.

### How can malicious traffic be distinguished from a legitimate traffic spike?

Compare request behavior, session and purchase progression, reputation, geography, device patterns and targeted endpoints. Avoid relying on traffic volume alone because real campaigns also spike.

### How does rate limiting help protect ecommerce systems?

Rate limiting constrains abusive request volume and protects scarce resources. Use different limits and responses for login, search, cart and checkout, so protection does not unnecessarily stop sales.

### A quick store check

Run a tabletop traffic attack and confirm CDN, rate limits, origin protection, provider contacts and customer communication.

---

## Frequently asked questions

### Should the origin server be publicly reachable behind a CDN?

Restrict origin access where architecture allows, so attackers cannot bypass edge protections.

### Can blocking one country stop a DDoS attack?

Rarely by itself; attacks can use distributed sources, and geographic blocking may harm legitimate customers.

## Related articles

- **Ecommerce Bots and Automated Abuse**
- **Ecommerce Payment Security and PCI DSS**